Information on DDoS attack

Hi,

I have a site that was attacked by a DDoS for three days. The company that I
rent the server decided to shut my server down. It was also causing problem
on their other server and even their own website was down. Is there any way
to defend a Win2K server against a DDoS attack ? We banned the IP from the
main router but theise guys just kept changing the IP the attack was comming
from.

Thank

Ken
Wed Aug 18 05:51:33 CDT 2004

A DDoS is a "distributed denial of service" attack - which means that you
have many hosts attacking your single host, and the remote hosts overwhelm
the server resources or bandwidth of your server.

If they are consuming server resources, we need to know what type of attack
it is - some kind of syn flood? etc

If they are consuming bandwidth, you need to move up the bandwidth pipe till
you get to a supplier that has more bandwidth than the attackers do. So,
talk to your ISP's bandwidth provider, and then their provider etc.
Ultimately, you'll probably need to speak to the ISPs that own the IP
addresses where the attacks are coming from, so they can shut down the
attacking machines.

Cheers
Ken

"Stephane SansCartier" <the_lotus@videotron.ca> wrote in message
news:XmGUc.103773$sk2.2837582@wagner.videotron.net...
> Hi,
>
> I have a site that was attacked by a DDoS for three days. The company that
> I
> rent the server decided to shut my server down. It was also causing
> problem
> on their other server and even their own website was down. Is there any
> way
> to defend a Win2K server against a DDoS attack ? We banned the IP from the
> main router but theise guys just kept changing the IP the attack was
> comming
> from.
>
> Thank
>
>

Stephane
Wed Aug 18 06:05:47 CDT 2004

It was mostly syn flood. The big problem is most IP were from an other
country, and there was a bunch of different ISP. I will still try to call
the ISP's


"Ken Schaefer" <kenREMOVE@THISadOpenStatic.com> wrote in message
news:OsmxTFRhEHA.3864@TK2MSFTNGP10.phx.gbl...
> A DDoS is a "distributed denial of service" attack - which means that you
> have many hosts attacking your single host, and the remote hosts overwhelm
> the server resources or bandwidth of your server.
>
> If they are consuming server resources, we need to know what type of
attack
> it is - some kind of syn flood? etc
>
> If they are consuming bandwidth, you need to move up the bandwidth pipe
till
> you get to a supplier that has more bandwidth than the attackers do. So,
> talk to your ISP's bandwidth provider, and then their provider etc.
> Ultimately, you'll probably need to speak to the ISPs that own the IP
> addresses where the attacks are coming from, so they can shut down the
> attacking machines.
>
> Cheers
> Ken
>
> "Stephane SansCartier" <the_lotus@videotron.ca> wrote in message
> news:XmGUc.103773$sk2.2837582@wagner.videotron.net...
> > Hi,
> >
> > I have a site that was attacked by a DDoS for three days. The company
that
> > I
> > rent the server decided to shut my server down. It was also causing
> > problem
> > on their other server and even their own website was down. Is there any
> > way
> > to defend a Win2K server against a DDoS attack ? We banned the IP from
the
> > main router but theise guys just kept changing the IP the attack was
> > comming
> > from.
> >
> > Thank
> >
> >
>
>

Ken
Wed Aug 18 22:24:55 CDT 2004

Speak to your ISP, and your ISP's ISP, and so forth. Do not bother about
contacting ISPs in other countries - have your ISP do that (or your ISP's
ISP).

Cheers
Ken

"Stephane SansCartier" <the_lotus@videotron.ca> wrote in message
news:pKGUc.104181$sk2.2855534@wagner.videotron.net...
> It was mostly syn flood. The big problem is most IP were from an other
> country, and there was a bunch of different ISP. I will still try to call
> the ISP's
>
>
> "Ken Schaefer" <kenREMOVE@THISadOpenStatic.com> wrote in message
> news:OsmxTFRhEHA.3864@TK2MSFTNGP10.phx.gbl...
>> A DDoS is a "distributed denial of service" attack - which means that you
>> have many hosts attacking your single host, and the remote hosts
>> overwhelm
>> the server resources or bandwidth of your server.
>>
>> If they are consuming server resources, we need to know what type of
> attack
>> it is - some kind of syn flood? etc
>>
>> If they are consuming bandwidth, you need to move up the bandwidth pipe
> till
>> you get to a supplier that has more bandwidth than the attackers do. So,
>> talk to your ISP's bandwidth provider, and then their provider etc.
>> Ultimately, you'll probably need to speak to the ISPs that own the IP
>> addresses where the attacks are coming from, so they can shut down the
>> attacking machines.
>>
>> Cheers
>> Ken
>>
>> "Stephane SansCartier" <the_lotus@videotron.ca> wrote in message
>> news:XmGUc.103773$sk2.2837582@wagner.videotron.net...
>> > Hi,
>> >
>> > I have a site that was attacked by a DDoS for three days. The company
> that
>> > I
>> > rent the server decided to shut my server down. It was also causing
>> > problem
>> > on their other server and even their own website was down. Is there any
>> > way
>> > to defend a Win2K server against a DDoS attack ? We banned the IP from
> the
>> > main router but theise guys just kept changing the IP the attack was
>> > comming
>> > from.
>> >
>> > Thank
>> >
>> >
>>
>>
>
>